org.apache.hadoop.security

Class SecurityUtil

java.lang.Object

org.apache.hadoop.security.SecurityUtil

@InterfaceAudience.Public
@InterfaceStability.Evolving
public final class SecurityUtil
extends Object

Security Utils.

Field Summary

Fields

Modifier and Type	Field and Description
static String	FAILED_TO_GET_UGI_MSG_HEADER
static String	HOSTNAME_PATTERN
static org.apache.commons.logging.Log	LOG

Method Summary

Methods

Modifier and Type	Method and Description
static String	buildDTServiceName(URI uri, int defPort) create the service name for a Delegation token
static Text	buildTokenService(InetSocketAddress addr) Construct the service key for a token
static Text	buildTokenService(URI uri) Construct the service key for a token
static <T> T	doAsCurrentUser(PrivilegedExceptionAction<T> action) Perform the given action as the daemon's current user.
static <T> T	doAsLoginUser(PrivilegedExceptionAction<T> action) Perform the given action as the daemon's login user.
static <T> T	doAsLoginUserOrFatal(PrivilegedAction<T> action) Perform the given action as the daemon's login user.
static UserGroupInformation.AuthenticationMethod	getAuthenticationMethod(Configuration conf)
static String	getHostFromPrincipal(String principalName) Get the host name from the principal name of format /host@realm.
static org.apache.hadoop.security.KerberosInfo	getKerberosInfo(Class<?> protocol, Configuration conf) Look up the KerberosInfo for a given protocol.
static String	getServerPrincipal(String principalConfig, InetAddress addr) Convert Kerberos principal name pattern to valid Kerberos principal names.
static String	getServerPrincipal(String principalConfig, String hostname) Convert Kerberos principal name pattern to valid Kerberos principal names.
static TokenInfo	getTokenInfo(Class<?> protocol, Configuration conf) Look up the TokenInfo for a given protocol.
static InetSocketAddress	getTokenServiceAddr(Token<?> token) Decode the given token's service field into an InetAddress
protected static boolean	isOriginalTGT(KerberosTicket ticket) Check whether the server principal is the TGS's principal
static boolean	isPrivilegedPort(int port)
static void	login(Configuration conf, String keytabFileKey, String userNameKey) Login as a principal specified in config.
static void	login(Configuration conf, String keytabFileKey, String userNameKey, String hostname) Login as a principal specified in config.
static void	setAuthenticationMethod(UserGroupInformation.AuthenticationMethod authenticationMethod, Configuration conf)
static void	setTokenService(Token<?> token, InetSocketAddress addr) Set the given token's service to the format expected by the RPC client

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

LOG

public static final org.apache.commons.logging.Log LOG

HOSTNAME_PATTERN

public static final String HOSTNAME_PATTERN

See Also:

Constant Field Values

FAILED_TO_GET_UGI_MSG_HEADER

public static final String FAILED_TO_GET_UGI_MSG_HEADER

See Also:

Constant Field Values

Method Detail

isOriginalTGT

protected static boolean isOriginalTGT(KerberosTicket ticket)

Check whether the server principal is the TGS's principal

Parameters:

ticket - the original TGT (the ticket that is obtained when a kinit is done)

Returns:

true or false

getServerPrincipal

@InterfaceAudience.Public
@InterfaceStability.Evolving
public static String getServerPrincipal(String principalConfig,
                                                                             String hostname)
                                 throws IOException

Convert Kerberos principal name pattern to valid Kerberos principal names. It replaces hostname pattern with hostname, which should be fully-qualified domain name. If hostname is null or "0.0.0.0", it uses dynamically looked-up fqdn of the current host instead.

Parameters:

principalConfig - the Kerberos principal name conf value to convert

hostname - the fully-qualified domain name used for substitution

Returns:

converted Kerberos principal name

Throws:

IOException - if the client address cannot be determined

getServerPrincipal

@InterfaceAudience.Public
@InterfaceStability.Evolving
public static String getServerPrincipal(String principalConfig,
                                                                             InetAddress addr)
                                 throws IOException

Convert Kerberos principal name pattern to valid Kerberos principal names. This method is similar to getServerPrincipal(String, String), except 1) the reverse DNS lookup from addr to hostname is done only when necessary, 2) param addr can't be null (no default behavior of using local hostname when addr is null).

Parameters:

principalConfig - Kerberos principal name pattern to convert

addr - InetAddress of the host used for substitution

Returns:

converted Kerberos principal name

Throws:

IOException - if the client address cannot be determined

login

@InterfaceAudience.Public
@InterfaceStability.Evolving
public static void login(Configuration conf,
                                                              String keytabFileKey,
                                                              String userNameKey)
                  throws IOException

Login as a principal specified in config. Substitute $host in user's Kerberos principal name with a dynamically looked-up fully-qualified domain name of the current host.

Parameters:

conf - conf to use

keytabFileKey - the key to look for keytab file in conf

userNameKey - the key to look for user's Kerberos principal name in conf

Throws:

IOException - if login fails

login

@InterfaceAudience.Public
@InterfaceStability.Evolving
public static void login(Configuration conf,
                                                              String keytabFileKey,
                                                              String userNameKey,
                                                              String hostname)
                  throws IOException

Login as a principal specified in config. Substitute $host in user's Kerberos principal name with hostname. If non-secure mode - return. If no keytab available - bail out with an exception

Parameters:

conf - conf to use

keytabFileKey - the key to look for keytab file in conf

userNameKey - the key to look for user's Kerberos principal name in conf

hostname - hostname to use for substitution

Throws:

IOException - if the config doesn't specify a keytab

buildDTServiceName

public static String buildDTServiceName(URI uri,
                        int defPort)

create the service name for a Delegation token

Parameters:

uri - of the service

defPort - is used if the uri lacks a port

Returns:

the token service, or null if no authority

See Also:

buildTokenService(InetSocketAddress)

getHostFromPrincipal

public static String getHostFromPrincipal(String principalName)

Get the host name from the principal name of format /host@realm.

Parameters:

principalName - principal name of format as described above

Returns:

host name if the the string conforms to the above format, else null

getKerberosInfo

public static org.apache.hadoop.security.KerberosInfo getKerberosInfo(Class<?> protocol,
                                                      Configuration conf)

Look up the KerberosInfo for a given protocol. It searches all known SecurityInfo providers.

Parameters:

protocol - the protocol class to get the information for

conf - configuration object

Returns:

the KerberosInfo or null if it has no KerberosInfo defined

getTokenInfo

public static TokenInfo getTokenInfo(Class<?> protocol,
                     Configuration conf)

Look up the TokenInfo for a given protocol. It searches all known SecurityInfo providers.

Parameters:

protocol - The protocol class to get the information for.

conf - Configuration object

Returns:

the TokenInfo or null if it has no KerberosInfo defined

getTokenServiceAddr

public static InetSocketAddress getTokenServiceAddr(Token<?> token)

Decode the given token's service field into an InetAddress

Parameters:

token - from which to obtain the service

Returns:

InetAddress for the service

setTokenService

public static void setTokenService(Token<?> token,
                   InetSocketAddress addr)

Set the given token's service to the format expected by the RPC client

Parameters:

token - a delegation token

addr - the socket for the rpc connection

buildTokenService

public static Text buildTokenService(InetSocketAddress addr)

Construct the service key for a token

Parameters:

addr - InetSocketAddress of remote connection with a token

Returns:

"ip:port" or "host:port" depending on the value of hadoop.security.token.service.use_ip

buildTokenService

public static Text buildTokenService(URI uri)

Construct the service key for a token

Parameters:

uri - of remote connection with a token

Returns:

"ip:port" or "host:port" depending on the value of hadoop.security.token.service.use_ip

doAsLoginUserOrFatal

public static <T> T doAsLoginUserOrFatal(PrivilegedAction<T> action)

Perform the given action as the daemon's login user. If the login user cannot be determined, this will log a FATAL error and exit the whole JVM.

doAsLoginUser

public static <T> T doAsLoginUser(PrivilegedExceptionAction<T> action)
                       throws IOException

Perform the given action as the daemon's login user. If an InterruptedException is thrown, it is converted to an IOException.

Parameters:

action - the action to perform

Returns:

the result of the action

Throws:

IOException - in the event of error

doAsCurrentUser

public static <T> T doAsCurrentUser(PrivilegedExceptionAction<T> action)
                         throws IOException

Perform the given action as the daemon's current user. If an InterruptedException is thrown, it is converted to an IOException.

Parameters:

action - the action to perform

Returns:

the result of the action

Throws:

IOException - in the event of error

getAuthenticationMethod

public static UserGroupInformation.AuthenticationMethod getAuthenticationMethod(Configuration conf)

setAuthenticationMethod

public static void setAuthenticationMethod(UserGroupInformation.AuthenticationMethod authenticationMethod,
                           Configuration conf)

isPrivilegedPort

public static boolean isPrivilegedPort(int port)